feat: [grpc] Add retry logic when certificate mismatch for existing credentials & Agent Identity workloads - #18019
Conversation
feat: Add passphrase handling to client cert callback
feat: Add cert rotation handling support
chore: Add passphrase in _mtls_helper for requests
…rase chore: Modify _mtls_helper call to include additional variable passphrase
Updated mock return values in test cases to include None for additional parameters.
Updated mock callback to return an additional None value.
Updated mock call_client_cert_callback to include a None value in the return tuple.
chore: Add unit tests for cert rotation handling for grpc
chore: Add tests for grpc cert roatation handling changes
There was a problem hiding this comment.
Code Review
This pull request introduces mTLS certificate rotation and automatic retry capabilities for gRPC transport by implementing a refreshing channel wrapper and call interceptors. It also updates helper utilities to support key passphrases. The review feedback suggests handling potential CancelledError exceptions gracefully when checking futures to prevent thread crashes, and recommends removing several redundant getattr checks for attributes that are guaranteed to be initialized in their respective class constructors.
| if len(self._parent._buffer) > getattr( | ||
| self._parent, "_max_items", 10000 | ||
| ): |
There was a problem hiding this comment.
Do not use defensive 'getattr' checks for attributes that are guaranteed to be initialized in the class's 'init' method. Since '_max_items' is always initialized in '_ReplayableIterator.init', you can access it directly.
if len(self._parent._buffer) > self._parent._max_items:References
- Do not use defensive getattr(self, 'attribute', None) checks for attributes that are guaranteed to be initialized in the class's init method, as it adds unnecessary complexity.
fix: Refactor gRPC call handling and state management
feat: [grpc] Add retry logic when certificate mismatch for existing credentials & Agent Identity workloads
This PR introduces mTLS certificate rotation and encrypted private key passphrase handling to the gRPC transport. It implements an interceptor and a refreshing channel to automatically reload client certificates upon authentication failures when certificates rotate. It also updates tests and mock return values across all transports.
See go/grpc-cert-rotation-in-pythonsdk-for-x509 for details.